package tool

import (
	"fmt"
	"strings"
	"time"
)

//可疑行为

func Suspicious() {

	//Exec_shell("vi /etc/profile")
	//Exec_shell("ls ~/.ssh")
	//Exec_shell("touch /etc/cron.d/1")
	//Exec_shell("touch /etc/yum.repos.d/test.d\n")
	//Exec_shell("vi /root/.ssh/known_hosts")
	//Exec_shell("touch /root/testxx")
	//Exec_shell("cat /etc/shadow")
	//Exec_shell("vi /var/lib/rpm/test")
	//Exec_shell("mkdir /usr/bin/testdir")
	//Exec_shell("mv /usr/bin/testdir /sbin")
	//Exec_shell("rmdir /bin/testdir")
	//Exec_shell("find -name id_rsa")
	//Exec_shell("echo 1 > /var/log/alternatives.log")
	//Exec_shell("rm -fr ~/.bash_historys")
	//Exec_shell("cp ~/.bash_history ~/.bash_historys")
	//Exec_shell("ln -s /etc/shadow /var/tmp/test")
	//Exec_shell("cat /etc/passwd")

	sh := []string{"vi /etc/profile", "touch ~/.ssh && ls ~/.ssh", "mkdir /etc/cron.d && touch /etc/cron.d/1",
		"mkdir /etc/yum.repos.d && touch /etc/yum.repos.d/test.d", "mkdir /root/.ssh && vi /root/.ssh/known_hosts",
		"touch /root/testxx", "touch /etc/shadow && cat /etc/shadow", "mkdir /var/lib/rpm && vi /var/lib/rpm/test",
		"mkdir /usr/bin/testdir", "touch /usr/bin/testdir && mv /usr/bin/testdir /sbin", "touch /bin/testdir && rmdir /bin/testdir",
		"find -name id_rsa", "echo 1 > /var/log/alternatives.log", "rm -fr ~/.bash_historys", "cp ~/.bash_history ~/.bash_historys",
		"ln -s /etc/shadow /var/tmp/test", "cat /etc/passwd"}

	fmt.Println("主机可疑行为开始")
	for i := 0; i < len(sh); i++ {
		fmt.Println(RunInLinux(sh[i]))
		time.Sleep(10 * time.Second)
	}
	fmt.Println("主机可疑行为结束")

	output := RunInLinux("docker ps | grep openssh-server")
	containerId := strings.Split(output, "  ")[0]
	fmt.Println(containerId)

	fmt.Println("容器可疑行为开始")
	for i := 0; i < len(sh); i++ {
		fmt.Println(RunInLinux("docker exec " + containerId + " sh -c \" " + sh[i] + " \""))
	}
	fmt.Println("容器可疑行为结束")
}
